CSM Security Policies & Procedures Development 2

Question 1

Which document type provides mandatory, specific technical requirements that support a high-level policy, such as minimum password length?

Accepted Answer

Standard

Answer

Standards define mandatory, measurable requirements that implement policy statements.

Question 2

A security guideline differs from a security standard primarily because a guideline is:

Accepted Answer

Recommended or advisory rather than mandatory

Answer

Guidelines offer recommended practices and flexibility, whereas standards are compulsory.

Question 3

Who should have final approval authority over an organization-wide information security policy?

Accepted Answer

Senior management or executive leadership

Answer

Executive approval demonstrates management commitment and gives the policy organizational authority.

Question 4

What is the main purpose of a baseline in security documentation?

Accepted Answer

To define the minimum acceptable security configuration for a system type

Answer

A baseline establishes a minimum consistent security level against which systems are measured.

Question 5

Which element of a well-formed policy states who is covered by it?

Accepted Answer

Scope

Answer

The scope section identifies the people, systems, and data to which the policy applies.

CSM - Certified Security Manager Practice Test